19 Audit Nags in One Night: Making a Claude Code Stop Hook Detect Unattended Sessions

Description and use

Implementing entrypoint checks and a fire‑cap in the Stop hook removed unwanted audit nags from unattended Claude Code runs while keeping alerts for humans.

Problem

Claude Code’s Stop hook nagged unattended automated runs, producing log noise and blocking CLI pipelines.

Outcome

Audit nags stopped appearing in unattended runs, pipeline executed cleanly, and human‑facing alerts remained limited to at most two per session.

Workflow

• Register Stop hook in ~/.claude/settings.json
• Create PostToolUse hook to set flag when a file‑modifying tool runs
• In Stop hook, if flag absent, exit 0
• If flag present, read first 15 lines of transcript to check entrypoint
• If entrypoint is "sdk-cli", delete flag and exit 0 (unattended session)
• Otherwise, check prompted counter file; if ≥2, delete flag and exit 0 (cap reached)
• If counter <2, check for audit marker in assistant text; if present, exit 0
• If marker absent, increment counter, delete flag, exit 2 to block and notify

Evidence

The hook itself decides whether a human or launchd opened this session.

Source

On the morning of 2026-07-12, I opened the logs and found 19 audit nags stacked up overnight.

Source